VA-002 practice questions 71–80

1. Question 71 · 88 in bank

   You have manually created some usernames and passwords for a Microsoft SQL database on Azure, and need to store these credentials in Vault. What secrets engine should you use for this?

   • AMSSQL database secrets engine
   • BKey/Value secrets engine version 2
   • CAzure secrets engine
   • DTransit engine

   Show answer

   Answer: B

   Explanation

   B is correct as you manually created credentials and didn't originally enable the Database Secrets Engine with the MSSQL plugin to create dynamic ones.

   Source: Adapted from community discussion — daz_rekka

   Next question

2. Question 72 · 88 in bank

   To create a non-root token with time-to-live (TTL) set to 30 minutes but with no max TTL which flag would you use?

   • A-ttl=30n
   • B-explicit-max-ttl=0
   • C-orphan
   • DNone of the above

   Show answer

   Answer: A

   References

   • HashiCorp documentation

   Next question

3. Question 73 · 88 in bank

   A user successfully logs into Vault with the following cURL command: curl --request POST --data @payload.json http://127.0.0.1:8200/v1/auth/ldap/login/mitchellh The response will include what information?

   • Aclient_token and policies
   • Baccess_key and policies
   • Caccess_key and secrets available
   • Dclient_token and secrets available

   Show answer

   Answer: A

   References

   • HashiCorp documentation

   Next question

4. Question 74 · 88 in bank

   Security requirements demand that no secrets appear in the shell history. Which command does not meet this requirement?

   • Agenerate-password | vault kv put secret/password value=-
   • Bvault kv put secret/password value=itsasecret
   • Cvault kv put secret/password value=@data.txt
   • Dvault kv put secret/password value=$SECRET_VALUE

   Show answer

   Answer: B

   Next question

5. Question 75 · 88 in bank

   Select 2

   Which of the following statements are true about the default policy? (Choose two.)

   • AIt is one of the built-in policies
   • BProvides a common set of permissions and is included on all tokens by default
   • CCan not be modified or deleted
   • DGives a super admin permissions, similar to a root user on a Linux machine
   • EVault upgrade will overwrite any update you made to the default policy

   Show answer

   Answer: AB

   References

   • HashiCorp documentation

   Next question

6. Question 76 · 88 in bank

   Why might an application be mapped to an identity entity?

   • ATo prohibit Vault administrators from revoking tokens associated with that application
   • BTo get around cloud license limitations
   • CTo allow an application deployed with multiple authentication methods have a consistent set of policies
   • DTo allow the same application in one cloud to access already provisioned Vault tokens for that application in another cloud

   Show answer

   Answer: C

   References

   • HashiCorp documentation

   Next question

7. Question 77 · 88 in bank

   Unsealing a single Vault server in a cluster unseals all Vault servers in that cluster.

   • ATrue
   • BFalse

   Show answer

   Answer: B

   Next question

8. Question 78 · 88 in bank

   Which endpoint can be used to list all tokens?

   • A/kv/secrets
   • B/auth/token/list
   • C/secrets/kv
   • D/auth/token/accessors

   Show answer

   Answer: D

   Next question

9. Question 79 · 88 in bank

   The mechanism to associate an authentication method with access to specific secrets is by specifying a/an:

   • AAccessor
   • BToken
   • CPolicy
   • DSecret

   Show answer

   Answer: C

   Next question

10. Question 80 · 88 in bank

    You are managing a Vault implementation that has been integrated with Azure SQL database to provide dynamic credentials. You have created a role that will provide database credentials for database administrators (DBAs) to use for managing their database in Azure SQL. A DBA has requested a new credential by issuing the following Vault CLI command: vault read azuresql/creds/dba_access. The following output is returned:

    

    The DBA has completed their work and would like to proactively remove the credential now that their work is complete. Which of the following commands should the DBA execute?

    • Avault delete azuresql/creds/dba_access
    • Bvault lease revoke v-token-dba_acccss-tr2t4x9pxvqlz8878s9s-1513446795
    • Cvault delete azuresql/creds/dba_access/2e5b1e0b-a081-c7el-5622-39f58e79a7l9
    • Dvault lease revoke azuresql/creds/dba_access/2e5b1e0b-a081-c7el-5622-39f58e79a719

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

VA-002 practice, question 71. 88 questions available.